In nearly every Microsoft 365 and Entra tenant I review, someone eventually asks how well our authentication methods are actually adopted and what the real security posture looks like, especially for admins. My first stop for that is the built-in authentication methods report in the Entra admin center, and it has become a fixed part of my regular security reviews. The useful part is in the details. Who still relies on SMS? Which admins have no phishing-resistant method? How fast are passkeys and the Authenticator app catching on?

The report sits under Activity and shows both registration and usage

You’ll find the authentication methods report in the Entra admin center under Protection → Authentication methods → Activity. The top of the page summarizes how many users have registered each method, including the Authenticator app, SMS, FIDO2 or passkey and others. The charts show the trend over the past weeks, so you can tell whether SMS is really going down or whether your passkey push is having an effect. And these aren’t just registration numbers. You also see which methods people actually use for MFA and passwordless sign-in. That matters when you track adoption campaigns or need to show progress on your roadmap to phishing-resistant MFA.

If you want more detail, the User registration details page lets you filter by method, flag admin users and find accounts that are registered but not really MFA-capable or passwordless. The filters have become fairly flexible by now. For heavier reporting or automation, use the userRegistrationDetails resource in Microsoft Graph, which you can also query from PowerShell to export the data and work with it further.

Admin accounts with weak methods carry most of the real risk

In my experience the biggest risks rarely sit in the general user base. They sit in administrator accounts that still hang on to weak or legacy methods, and that is where targeted reporting pays off. In the user registration details view you can filter for users with admin roles and see right away who hasn’t registered a FIDO2 key, a passkey or even the Authenticator app. If coverage is thin, that list is a good starting point for targeted registration campaigns.

I often get asked how to get the data out for custom dashboards, audits or follow-up work. With the Microsoft Graph PowerShell SDK (requires Entra ID P1 and at least Reports Reader permissions), Get-MgReportAuthenticationMethodUserRegistrationDetail exports which methods each user has, whether they are MFA-capable, whether they are an admin, and more. This is a script I use regularly:

# Prerequisites: Microsoft Graph PowerShell, signed in with reporting rights
Connect-MgGraph -Scopes "Reports.Read.All"
Get-MgReportAuthenticationMethodUserRegistrationDetail |
  Where-Object { $_.IsAdmin -eq $true -and $_.IsMfaCapable -eq $false } |
  Select-Object UserPrincipalName, IsAdmin, IsMfaCapable, MethodsRegistered

It returns a list of admins who aren’t protected by strong MFA. Export that to CSV and you can feed dashboards or send targeted messages to the people concerned.

Practical tip: If you want SMS usage to drop and passkey adoption to rise, look at the usage charts in the report once a month and run targeted registration campaigns for the groups that lag behind. The campaign feature speeds things up considerably.

Monthly exports show whether SMS declines and passkeys grow

When you roll out phishing-resistant methods across the tenant, you need to follow the actual trend. The built-in usage charts are fine for a first look. For historical comparisons or a breakdown by business unit, though, I export the data every month with PowerShell or Microsoft Graph. That way you can measure how many admins or users in a particular group have moved to passkeys and whether SMS is really on its way out. When you report to management or the works council, having that evidence in hand helps a lot.

The flowchart below shows how these data sources fit together:

flowchart TD
    EntraAdminCenter["Entra admin center"] --> ReportOverview["Activity report"]
    EntraAdminCenter --> UserDetails["User registration details"]
    ReportOverview --> Trends["Method usage charts"]
    UserDetails --> Filters["Admin/MFA/Passkey filters"]
    PowerShell["Graph PowerShell"] --> Export["userRegistrationDetails export"]
    Export --> FurtherAnalysis["CSV/internal analytics"]

Figure: Data sources and analysis path for the authentication methods report

Full reporting requires Entra ID P1 or P2

Keep in mind that the full reporting features need Entra ID P1 or P2, in particular for exporting details and using the advanced filters. With only Microsoft 365 Standard or Business licenses, the usage insights aren’t available. The usage reporting feature also has to be enabled for the tenant, otherwise you’ll see empty or outdated data.

For a more thorough analysis you can combine this data with sign-in logs (for example in Log Analytics) to separate registration from actual use. For most governance and security reviews, though, the built-in reports and the Graph exports are more than enough.

Regular reporting is what actually drives improvement

I keep seeing the same pattern. A one-off audit gets forgotten quickly, while a monthly look at the authentication methods report creates real transparency and steady progress. You see which groups or admins are still behind, and you can measure what your registration campaigns or the phaseout of legacy methods have achieved. In 2025, passwordless and passkey adoption has become a management and compliance topic, so having this data ready is a clear advantage, especially when the works council, compliance or the CISO starts asking questions. For me, reviewing the authentication methods report as a routine habit has been what made the difference, both for improving things and for proving security progress when it counted.